MalwareRetail & ConsumerRetailSkimmerCapture App DataCustomer Data InvolvedData ExfiltratedIdentity (basic)Financial accountLowContained

Blue Diamond Herbs LLC

bd_8bcb302bed7e24f9 · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 29, 2024

Filed

May 19, 2026

To disclose

—

Affected

2state residents only

Confidence

95%

Full breach record for Blue Diamond Herbs LLC →2 incidents on file

Blue Diamond Herbs LLC discovered suspicious activity on its website on September 29, 2024. By November 22, 2024, it confirmed a bad actor had embedded malicious code to intercept customer credit card data. Two Maryland residents were affected, with name, home address, and credit card numbers potentially compromised. The malicious code was removed and the website relaunched with enhanced security features. Kroll identity monitoring was offered to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

Sep 29, 2024

Discovered

Nov 22, 2024

Scope determined

May 19, 2026

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2 affectedView incident

Name: Blue Diamond Herbs LLC
norm: blue diamond herbs

Name: Blue Diamond Herbs LLC
norm: blue diamond herbs
Industry: Retail & Consumerllm

Discovered: Sep 29, 2024
Materiality determined: Nov 22, 2024
Notification sent: Jan 7, 2025
Affected individuals: 2state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1056 Input CaptureT1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Notified Maryland Office of the Attorney General, Security Breach Notification
Initial access: exploit_public_facing

During the incident: Began immediately working with IT cybersecurity experts to assist in investigating the situation
Temporarily suspended the acceptance of credit cards from its website
Removed the malicious code from the website
Launched an updated website with enhanced security features
Secured the services of Kroll to provide free identity monitoring to affected individuals
Changes made: Launched a new website with enhanced security features for processing payments
Redoubling efforts to strengthen security to help protect customer data
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376126.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 19, 2026
Raw hash: 360f5cdb2178d9bd9619449be294f0535be124d2e81461f469df120d09f16be8

Reporting entityBlue Diamond Herbs LLC

Victim entityBlue Diamond Herbs LLC

Incidentdiscovered Sep 29, 2024

Stated responseBegan immediately working with IT cybersecurity experts to assist in investigating the situation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.maryland.gov